Fortigate-60e v5.6.3 Custom NTP server issue

[Camshaft007]

All,

I'm currently attempting to make my FGT the singe source of truth for all my internal networks as the NTP server which is working fine.  However, I want my my FGT to update to a custom external NTP server instead of Using Fortiguard as my source for time.  After digging for a few hours, I've come to the conclusion that there is either a bug in the code or a limitation on the device which does not support custom NTP server configuration(s).  I find this not cool at all and I'm hoping that perhaps I'm missing something here.  Below is what I've tried..

[size="1"]FGT60E (ntp) # sh full[/size] [size="1"]config system ntp[/size] [size="1"]  set ntpsync enable[/size] [size="1"]  set type fortiguard[/size] [size="1"]  set syncinterval 60[/size] [size="1"]  set source-ip 10.10.10.254[/size] [size="1"]  set server-mode enable[/size] [size="1"]  set interface "internal1" "internal2" "internal3" "internal4" "internal5" "internal6"[/size] [size="1"]end[/size]

[size="1"]FGT60E (ntp) # set type custom[/size]

[size="1"]FGT60E (ntp) # end[/size] [size="1"]There isn't any ntpserver ![/size] [size="1"]object set operator error, -651 discard the setting[/size] [size="1"]Command fail. Return code -651[/size]

[size="1"]FGT60E # config system ntp[/size]

[size="1"]FGT60E (ntp) # set type custom[/size]

[size="1"]FGT60E (ntp) # set ?[/size] [size="1"]  ntpsync Enable/disable setting the FortiGate system time by synchronizing with an NTP Server.[/size] [size="1"]  type Use the FortiGuard NTP server or any other available NTP Server.[/size] [size="1"]  syncinterval NTP synchronization interval (1 - 1440 min).[/size] [size="1"]  source-ip Source IP for communications to the NTP server.[/size] [size="1"]  server-mode Enable/disable FortiGate NTP Server Mode. Your FortiGate becomes an NTP server for other devices on your network. The FortiGate relays NTP requests to its configured NTP server.[/size] [size="1"]  interface FortiGate interface(s) with NTP server mode enabled. Devices on your network can contact these interfaces for NTP services.[/size]

[size="1"]FGT60E (ntp) # unset source-ip[/size]

[size="1"]FGT60E (ntp) # end[/size] [size="1"]There isn't any ntpserver ![/size] [size="1"]object set operator error, -651 discard the setting[/size] [size="1"]Command fail. Return code -651[/size]

[size="1"]FGT60E # diagnose debug config-error-log read[/size]

Any help from the community is much appreciated.

[ede_pfau]

hi,

you need to continue like this:

config ntpserver

   edit 1

      set server 192.53.103.104 (for example)

   next

end

Sometimes there is a subsection opening with "config ..." and ending with "end", like in this case.

And no, there's no video for this, it's all documented in the CLI Reference :)

[Camshaft007]

Oh man ede_pfau, you're my freggin hero!  This was so annoying.. And your right, it's mentioned in the CLI guide.. I didn't know the 5.6.3 guide was available, i should have gone there first.

FGT60E (ntp) # sh full
config system ntp
    set ntpsync enable
    set type custom
    set syncinterval 60
    config ntpserver
        edit 1
            set server "time.nist.gov"
            set ntpv3 disable
        next
    end
    set source-ip 0.0.0.0
    set server-mode enable
    set interface "internal1" "internal2" "internal3" "internal4" "internal5" "internal6"
end

[ede_pfau]

uh-oh, I looked it up in the 4.3 guide from 2012...

just kiddin'

and thanks for your hint to all of us to use the "show full" after setting 'set type custom'. Often quicker than a lookup.